/*
 * Profiles.c
 * Profiler to classify malware into generic categories
 * @author Gregoire JACOB (gregoire.jacob@orange-ftgroup.com)
 * @date 01/12/2008
 * @version 1.0
 * Profiles defining the predicates for the different categories of malware
 */

#include ".\Includes\MalwareProfiler.h"


void writeXMLPreamble(FILE * prf){
	fprintf(prf,"<?xml version=\"1.0\"?>\n");
	fprintf(prf,"<!DOCTYPE Profile [\n");
	fprintf(prf,"\t<!ELEMENT Profile (Class)*>\n");
	fprintf(prf,"\t<!ELEMENT Category EMPTY>\n");
	fprintf(prf,"\t<!ATTLIST Category class CDATA #REQUIRED>\n");
	fprintf(prf,"\t<!ATTLIST Category subclass CDATA #IMPLIED>\n");
	fprintf(prf,"]>\n\n\n");
}


void checkVirusProfile(FILE * prf){
	int i;
	int virus = 0;
	int overwriter = 0;
	int infector = 0;
	
	//Checking duplication properties
	for(i=0;i<nbduplication;i++){
		if(duplicationbase[i].targetstatus==1){
			virus = 1;
			if(duplicationbase[i].flow==0){
				overwriter = 1;
			}else{
				infector = 1;
			}
		}
	}
	//Storing results
	if(overwriter) 
		fprintf(prf,"\t<Category class=\"virus\" subclass=\"file-overwriter\"/>\n");
	if(infector)
		fprintf(prf,"\t<Category class=\"virus\" subclass=\"file-infector\"/>\n");
}


void checkEmailWormProfile(FILE * prf){
	int i;
	int mworm = 0;
	
	//Checking duplication properties
	if(nbduplication<1) return;
	//Checking residency properties
	if(nbresidency<1) return;
	//Checking propagation properties
	for(i=0;i<nbpropagation;i++){
		if(propagationbase[i].interfacenature==6){
			mworm = 1;
			break;
		}
	}
	//Storing results
	if(mworm) 
		fprintf(prf,"\t<Category class=\"email-worm\"/>\n");
}


void checkP2PWormProfile(FILE * prf){
	int i;
	int p2pworm = 0;
	
	//Checking duplication properties
	if(nbduplication<1) return;
	//Checking residency properties
	if(nbresidency<1) return;
	//Checking propagation properties
	for(i=0;i<nbpropagation;i++){
		if(propagationbase[i].interfacenature==1
			|| propagationbase[i].interfacenature==2){
			p2pworm = 1;
			break;
		}
	}
	//Storing results
	if(p2pworm) 
		fprintf(prf,"\t<Category class=\"peer-to-peer-worm\"/>\n");
}


void checkIRCWormProfile(FILE * prf){
	int i;
	int ircworm = 0;
	
	//Checking duplication properties
	//Checking propagation properties
	if(nbduplication<1&&nbpropagation<1) return;
	//Checking residency properties
	if(nbresidency<2) return;
	for(i=0;i<nbresidency;i++){
		if(strcasestr(residencybase[i].targetname,"script.ini")
			|| strcasestr(residencybase[i].targetname,"mirc")){
			ircworm = 1;
			break;
		}
	}
	//Storing results
	if(ircworm) 
		fprintf(prf,"\t<Category class=\"irc-worm\"/>\n");
}


void checkNetWormProfile(FILE * prf){
	int i;
	int networm = 0;
	
	//Checking propagation properties
	for(i=0;i<nbpropagation;i++){
		if(propagationbase[i].interfacenature==5){
			networm = 1;
			break;
		}
	}
	//Storing results
	if(networm) 
		fprintf(prf,"\t<Category class=\"network-worm\"/>\n");
}

void checkDriveWormProfile(FILE * prf){
	int i;
	int dworm = 0;
	int amovible = 0;
	
	//Checking duplication properties
	for(i=0;i<nbpropagation;i++){
		if(propagationbase[i].interfacenature==3){
			dworm = 1;
			break;
		}
	}
	//Checking residency properties
	for(i=0;i<nbresidency;i++){
		if(strcasestr(residencybase[i].targetname,"autorun.inf")){
			amovible = 1;
			break;
		}
	}
	//Storing results
	if(dworm){ 
		fprintf(prf,"\t<Category class=\"drive-worm\" ");
		if(amovible){
			fprintf(prf,"subclass=\"amovible-drive-propagation\"/>\n");
		}else{
			fprintf(prf,"subclass=\"generic-drive-propagation\"/>\n");
		}		
	}
}

void checkTrojanProfile(FILE * prf){
	int i;
	int trojan = 0;
	
	//Checking duplication and execution properties
	if(nbduplication<1||nbexecution<1) return;
	//Storing results
	fprintf(prf,"\t<Category class=\"trojan\"/>\n");
}